# Create a signing session (/docs/api-reference/signature-requests/create-sign-session)

A short-lived link to the signing page for one `embedded` signer of a sent request. Your app vouches for who the signer is (the audit trail records `customer_asserted`), so create it only for that signed-in user, when they open the page that shows it. Embed the `url` in an iframe from an origin in your Sign settings' `allowed_origins` (`mountSigning` from `coss/sign` does it), or redirect to it. Each call creates a new session.

`POST https://api.coss.com/v1/sign/requests/{id}/signers/{signer_id}/sessions`

Authenticate with your API key as a bearer token (`Authorization: Bearer coss_test_…`). Responses are JSON with snake_case fields; errors are `{ error: { type, code, message, param?, issues?, request_id } }` (https://coss.com/docs/api-reference/errors.md).

## Path parameters

- `id` (string, required): The signature request's id.
- `signer_id` (string, required): The signer's id (`signers[].id` of the request).

## Request body

- `expires_in` (integer, 60-86400): Seconds until the link expires: default 3600, at most 86400. Mint one when your user opens the page that shows it.

## Example request

TypeScript (the `coss` package):

```ts
import { Coss } from "coss";

const coss = new Coss({
  apiKey: process.env.COSS_API_KEY,
  baseUrl: "https://api.coss.com",
});

const { data, error } = await coss.sign.sessions.create("sreq_01k7c8m4q2f3e9v6t5r1n0p8yz", "ssgn_01k7c8m4q2f3e9v6t5r1n0p8yz", {
  expires_in: 3600,
});
```

HTTP:

```sh
curl -X POST "https://api.coss.com/v1/sign/requests/sreq_01k7c8m4q2f3e9v6t5r1n0p8yz/signers/ssgn_01k7c8m4q2f3e9v6t5r1n0p8yz/sessions" \
  -H "Authorization: Bearer $COSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "expires_in": 3600
}'
```

## Response 201

The session, with its link.

- `object` ("sign_session", required)
- `id` (string, required)
- `request_id` (string, required)
- `signer_id` (string, required)
- `url` (string, required): The signing page: embed it in an iframe (from an allowed origin, with `coss/sign`'s `mountSigning`) or redirect to it. The token is in the URL fragment, so it never reaches a server log: show it only to that signer.
- `token` (string, required): The secret part of `url`, shown only here.
- `expires_at` (string, required, date-time)

Example:

```json
{
  "object": "sign_session",
  "id": "sgs_01k7c8m4q2f3e9v6t5r1n0p8yz",
  "request_id": "sreq_01k7c8m4q2f3e9v6t5r1n0p8yz",
  "signer_id": "ssgn_01k7c8m4q2f3e9v6t5r1n0p8yz",
  "url": "https://sign.example/s/sgs_01k7c8m4q2f3e9v6t5r1n0p8yz#cosss_…",
  "token": "cosss_…",
  "expires_at": "2026-10-26T15:04:05.000Z"
}
```

## Errors

- `400`: The `Coss-Version` header names an unknown API version (`invalid_api_version`).
- `401`: The API key is missing, invalid, revoked or expired (`authentication_error`).
- `403`: The API key lacks the permission this endpoint needs (`permission_error`), or its organization is suspended (`organization_suspended`).
- `404`: No such signer on a signature request in the API key's environment (`not_found`).
- `422`: The signer signs by email (`signer_not_embedded`), already signed or declined (`signer_finished`), or the request isn't `sent` or has expired (`request_not_signable`).
- `429`: Too many requests with this API key (`rate_limited`), or too many requests with invalid keys from this address (`too_many_failed_authentications`). Retry after `Retry-After` seconds. Successful responses carry `RateLimit-Limit`, `RateLimit-Remaining` and `RateLimit-Reset` (seconds until the limit is fully restored).
- `500`: Unexpected server error (`api_error` / `internal_error`).
- `503`: Sign isn't available in this deployment yet (`sign_unavailable`).